Certificate problems

[Colin Moors]

Before installing SIM 4.2 (following a major issue with 4.1) I have been having a lot of problems with certificates. I am fairly up to speed with server stuff, but have never had to use certificates before.

I had things working OK in 4.1, but am having difficulty with 4.2.

All actions described here take place on the CIM itself, not from a remote browser.

When SIM starts (from the desktop icon) it runs the server status check briefly, then continues loading the SIM main page. Every time, I get two dialogue boxes, the first is from windows certificate services telling me the security certificates don't match (browser launches SIM as "localhost:50000", and the url should probably be "myserver.mycompany.com:50000"), and the second from the Java console, telling me the same thing.

I'm also having problems with the trust relationships with the VCRM (also hosted on the CIM) and the VC management on managed servers (no trust exists). I just know there's something I'm not doing, but I can't figure out what!

ML370G3
PSP 7.2
IE 6.0.2800.1106
Java 2 Runtime Environment SE v1.4.1_07
SIM 4.2

Thanks in advance for any help you may be able to offer.

-C-

[Seemueller, Andreas · Accepted solution]

Hi Colin,

when you have established the SSL connection to the SIM server you can see a small lock icon in the status bar of your browser.
When you doubleclick it in IE for example there is field named "Issued to:". The value of this field should usually be the fully qualified domain name of your server.
If the URL you type in ist not identically to this value of the certificate you get a warning message from your browser as well as from the Java runtime environment.

I would simply recommend to access HPSIM via https://myserver.mycompany.com:50000 event if you are connected locally. Just modifiy the shortcut on your desktop. The TCP/IP-stack of the operating systems avoids sending the traffic out to the network and handles it locally so you should notice no performance issues.

For the VCRM trust issue you have to set the Insight Managment Agents on the target systems to "trust by certificate" and import the certificate.
Then you should be able to access the System Managment Homepage without entering the Web agent password when you click on the link in HPSIM.

Best regards

Andi

[Colin Moors]

Andi,

Many thanks for the reply. The push of the certificate to the other agents worked just fine. I checked the certificate in the browser bar as you suggested - it was issued from and to the same server (FQDN) i.e. myserver.mycompany.com. If I try to connect using https://myserver.mycompany.com:50000 on the local machine, I get "access denied".

I have tried from a browser and it works fine, once I install the certificate that myserver.mycompany.com issues itself - no java errors, no certificate errors. This is fine, but I still haven't been able to tackle the initial problem, and I'm concerned that it may affect other areas of operation.

One other thing - when I start SIM from the installed icon, the URL in the bar states "http://localhost:280" which then changes to "https://localhost:50000" Is there some way of configuring the checksvc.exe to make it use the FQDN?

Again, thanks for the useful pointers.